ML17332B013

Proposed Tech Specs Modifying Surveillance Testing of EDG During Refueling & Normal Operations

ML17332B013
Person / Time
Site:	Cook
Issue date:	11/10/1995
From:	INDIANA MICHIGAN POWER CO. (FORMERLY INDIANA & MICHIG
To:
Shared Package
ML17332B012	List: ML17332B011 ML17332B013
References
NUDOCS 9511160295
Download: ML17332B013 (55)

Text

ELECTRICAL POWERSYSTEMSSURVEILLANCE REUIREHENTS Continued 4.8.1.1.2 Eachdieselgenerator shallbedemonstrated OPERABLE-Inaccordance withthefrequency specified inTable4.8"1onaSTAGGEREO TESTBASISby:1.2.3.5.fromstandtrycondidons andacldevesInlessthanorequalto10seconds.vottage~at60na20 V,andfrequency i60nl.2Hz.Verifying thefuellevelinthedaytank,Verifying thefuellevelinthefuelstoragetank,Verifying thatthefueltransferpumpcanbestartedandthatittransfers fuelfromthestoragesystemtothedaytank,Verifying thatthedieselstartsb.C.nd6.'"Verifying thatthedieselgenerator is.alignedtoprovidestandbypowertotheassociated emergency busses.Bgremoving accumulated water"+1)Fromthedaytankatleastonceper31.:daysandaftereachoccasionwhenthedieselisoperatedforgreatei'han 1hour,and2)Fromthestoragetanksatleastonceper31days.Bysamplingnewfueloil"<inaccordance withtheapplicable guidelines ofASTM04057-81priortoaddingnewfueltothestoragetanksandVerlfylng thergesetlssynchroAlted andloadedandcneratesforgreaterthanor~qualto60minutesataloadol3500Inv,1)Byverifying, inaccordance withthetestsspecified inASTH0975-81andpriortoaddingthenewfueltothestoragetanks,thatthesamplehas:Thedieselgenerator start10secondsfromconditions shabeperformed atleastonceper184daysinthesesurveillance tests.Allotherenginestartsforthepurposeofthissurveillance testingandcompensatory actionmaybeatreducedacceleration ratesasrecommended bythemanufacturer sothatmechanical stressandwearonthedieselengineareminimized.

kkMomcntnyloadtransients donotinvalidate thistest.+""Theactionstobetakenshouldany'oftheproperties befoundoutsideofspecifiedlimitsare'defined intheBases.O.C.COOK"UNIT13/48-3AMENOMENT NO.'si5111'60295 951110,'PDRADOCK,05000515P-.,"PDR..~484NUI~Jl"lIIe'1%ihr'I~46l~C4,r,HM:~alllallslate~

'~IRlWt~tl'+IP phag~T/5NILKuPstopowsrfsolofoftossthonor~rtosltoO.BBforsttssstBfactors.+

SCoeuedc)Verifying thatallaueomaeic diesel.generaeor trips,exceptengineoverspeed andgenerator differential, areautomaeically bypasseduponlossofvoleageontheemergency busand/orSafetyInjecei.on accuaeion signal.7.Verifying thatthedieselgeneraeor operatesDuringthistestthedieselgeneracor shallbeloadedto3500kw.Within5minutesaftercompleeing this~~hourtest,performSurveillance Requiremene 4.8.1.1.2.a.4 (atexistingconditions)

.*+8.Determine thattheaueo-connected loads.toeachdieselgenerator donotexceed3500kw.9.Verifying thedieselgeneraeor's capability eo:a)Synchronize withtheoffsieepowersourcewhileehegeneraeor isloadedwithitsemergency loadsuponasimulated restoration ofoffsieepower.Ib)Transferitsloadseotheoffsitepowersource,andc)Bereseoredeoitsseandbyseaeus.10.Verifying thaewiththedieselgeneraeor operaeing inatesemodeawhileconnected toitstestload,asimulated SafetyInjection signaloverrides thetestmodeby:a)Returning thedieseLgeneraeor eoseandbyoperaeion, andb)Verifying theemergency loadsareservicedbyoffsitepower.11.Verifying thaetheautomatic sequencetimingrelaysareOPERABLEwitheachloadsequencetimewiehinplusorminus5%ofiesrequiredvalueand'thaeeachloadissequenced onwithinthedesignallowable timeLimit.Aeleaseonceper10yearsby:1)Employing oneofthefollowing cleaningmethodseocleanthefueloilstoragetanks:a)DraineachfueLoilseorageeank,remove.theaccumulaeed

sedimene, andcleantheeank,or*+IfSurveillance Requirement 4.8.L.1.2.a.4 isaoesaeisfaceorily compleeed, ieisnoenecessary eorepeatthepreceditqp'Zdo-hour test.Instead,thedieselgeneraeor maybeoperaeadae3500kwfor2hoursorunciloperating temperature hasseabilized.

Momsntaytrsnslsnts otrtstdotftofoodsnc'owerfstsorrsntfodonotfrwsMstotnfsttst.COOKNUCLEARPLANT-UNIT13/48-6AMENDMEHT NO.424 P.ly1IC ELECTRICAL POWERSYSTEMSSURVEILLAHCE REUIREMEHTS Continued pftesqfrf 1/srnftfticvp 4.8.1.1.2 Eachdieselgenerator shallbedemonstrated OPERABLE:

Inaccordance withthefrequency specified inTable4.8-1onaSTAGGEREO TESTBASISby:l.2.3.Verifying thefuellevelinthedaytank,Verifying thefuellevelinthefuelstorageVerifying thatthefueltransferpumpcanbeittransfers fue1fromthestoragesystemtoVerifying thatthedieselstartstank,startedandthatthedaytank,Fromstandbyconrstfons and~VivosInlessthanorcorralto10seconds,volteqeidt60aa20 V.sndfrequency

~60*1.2Ht.b.and6.:"-Verifying thatthedieselgenerator isalignedtoprovidestandbypowertotheassociated emergency busses.Bfremovingaccumulated water"W~~1)Fromthedaytankatleastonceper33,-daysandaftereachoccasionwhenthedieselisoperatedforgreatirthan1hour,andVerffyfntf thedfeseffssynclvonrted andloadedandoperatesfortfreaterthenor~qrrafto60mfnrrtesataloadof3500fnv,C.2)Fromthestoragetanksatleastonceper31days.Bysamplingnewfueloil~+inaccordance withtheapplicable guidelines ofASTM04057-81priortoaddingnewfueltothestoragetanksand1)Byverifying, inaccordance withthetests.specified inASTH0975-81andpriortoaddingthenewfueltothestoragetanks,thatthesamplehas:"hedieselgenerator start10secondsromconditions shaeperformed atleastonceper184daysinthesesurveillance tests.Allotherenginestartsforthepurposeofthissurveillance testingandcompensatory actionmaybeatreducedacceleration ratesasrecommended bythemanufacturer sothatmechanical stressandwearonthedieselengineareminimized.

Morncntaty loadtransients donotinvalidate dtistest""Theactionstobetakenshouldanyoftheproperties befoundoutsideofspecified limitsareldefinedintheBases.0.C.COOK-UNIT23/48-3AHEHOHEHT HO.

Ef1,~,l~tv<A otued7.c)Verifying thatallautomatic dieselgenerator trips,exceptengineoverspeed andgenerator differential, areautomatically bypasseduponlossofvoltageontheemergency busand/orSafetyIn]ectionactuation signal.et~powerfooter~qoetto0.88lorVerifying thatthedieselgenerator operates~etreset8horrre.$Duringthistestthedieselgenerator shallbeloadedto3500kv.Within5minutesaftercompleting this~-hourtest,performSurveillance Requirement 4.8.1.1.2.a.4 (atexistingconditions).*f-8.Determine thattheauto-connected loads'toeachdieselgenerator donotexceed3500kv.9.Verifying thedieselgenerator's capability to:a)Synchronize withtheoffsitepowersourcevhilethegenerator isloadedvithitsemergency loadsuponasimulated restoration ofoffsitepower.bfTransferitsloadstotheoffsitepowersource,andc)Berestoredtoitsstandbystatus.10.Verifying thatviththedieselgenerator operating inatestmodewhileconnected toitstestload,asimulated SafetyInjection signaloverrides thetestmodeby:a)Retuz~igthedieselgenerator tostandbyoperation, andb)Verifying theemergency loads'ara servicedbyoffsitepover.11.Verifying thattheautomatic sequencetimingrelaysareOPERABLEwitheachloadsequencetimewithinplusorminus5%ofitsrequiredvalueandthateachloadissequenced onwithinthedesignallovable timelimit.rAtleastonceper10yearsby:1)Employing oneofthefollowing cleaningmethodstocleanthefueloilstoragetanks:a)Draineachfueloilstoragetank,removetheaccumulated

sediment, andcLeanthetank,or*+IfSurveillance Requirement 4.8.1.1.2.a.4 isnotsatisfactorily completed, itisnotnecessary torepeatthepreceding+-hour test.Instead,thedieselgenerator maybeoperatedat3500kvfor2hoursoruntiloperating temperature hasstabilized.

powerrectorrangeoonotlrrregdete thleteel.COOKNUCLZMPLANT-UNIT23/48-6AMENDMEHT NO.4XQ+66-ATTACHMENT 3TOAEP:NRC:0896K PROPOSEDREVISEDTECHNICAL SPECIFICATION PAGES

,03/4LIMITINGCONDITIONS FOROPERATION ANDSURVEILLANCE REQUIREiiTS 3/4.8ELECTRICAL POWERSYSTEMSSURVEILLANCE REUIREMENTS Continued 4.8.1.1.2 Eachdieselgenerator shallbedemonstrated OPERABLE:

a0Inaccordance withthefrequency specified inTable4.8-1onaSTAGGERED TESTBASISby:1.Verifying thefuellevelinthedaytank,2.Verifying thefuellevelinthefuelstoragetank,3.Verifying thefueltransferpumpcanbestartedandthatittransfers fuelfromthestoragesystemtothedaytank,Verifying thedieselstartsfromstandbyconditions andachievesinlessthanorequalto10seconds,voltage=4160~420V,andfrequency

=60+1.2Hz,Verifying thedieselissynchronized andloadedandoperatesforgreaterthanorequalto60minutesataloadof3500kw",and6.Verifying thedieselgenerator isalignedtoprovidestandbypowertotheassociated emergency busses.Byremovingaccumulated water1)Fromthedaytankatleastonceper31daysandaftereachoccasionwhenthedieselisoperatedforgreaterthan1hour,and2)Fromthestoragetanksatleastonceper31days.Bysamplingnewfueloil"inaccordance withtheapplicable guidelines ofASTMD4057-81priortoaddingnewfueltothestoragetanksand1)Byverifying, inaccordance withthetestsspecified inASTMD975-81andpriortoaddingthenewfueltothestoragetanks,thatthesamplehas:Thedieselgenerator start(10seconds)fromstandbyconditions shallbeperformed atleastonceper184daysinthesesurveillance tests.Allotherenginestartsforthepurposeofthissurveillance testingandcompensatory actionmaybeatreducedacceleration ratesasrecommended bythemanufacturer sothatmechanical stressandwearonthedieselengineareminimized.

Momentary loadtransients donotinvalidate thistest.TheactionstoUetakenshouldanyoftheproperties befoundoutsideofspecified limitsaredefinedintheBases.COOKNUCLEARPLANT-UNIT 1Page3/48-3AMEXDiWIENT

~

il~I'il 3/4LIMITINGCONDITIONS FOROPERATION ANDSURVEILLANCE REQUIREMENTS 3/4.8ELECTRICAL POWERSYSTEMSSURVEILLANCE REUIREMENTS Continued c)Verifying thatallautomatic dieselgenerator trips,exceptengineoverspeed andgenerator differential, areautomatically bypasseduponlossofvoltageontheemergency busand/orSafetyInjection actuation signal.Verifying thatthedieselgenerator operatesatapowerfactoroflessthanorequalto0.86foratleast8hours.Duringthistestthedieselgenerator shallbeloadedto3500kw.Within5minutesaftercompleting this8-hourtest,performSurveillance Requirement 4.8.1.1.2.a.4 (atexistingconditions)."

Determine thattheauto-connected loadstoeachdieselgenerator donotexceed3500kw.9.Verifying thedieselgenerator's capability to:a)Synchronize withtheoffsitepowersourcewhilethegenerator isloadedwithitsemergency loadsuponasimulated restoration ofoffsitepower.b)Transferitsloadstotheoffsitepowersource,andc)Berestoredtoitsstandbystatus.10.Verifying thatwiththedieselgenerator operating inatestmodewhileconnected

,toitstestload,asimulated SafetyInjection signaloverrides thetestmodeby:a)Returning thedieselgenerator tostandbyoperation, andb)Verifying theemergency loadsareservicedbyoffsitepower.11.Verifying thattheautomatic sequencetimingrelaysareOPERABLEwitheachloadsequencetimewithinplusorminus5%ofitsrequiredvalueandthateachloadissequenced onwithinthedesignallowable timelimit.Atleastonceper10yearsby:Employing oneofthefollowing cleaningmethodstocleanthefueloilstoragetanks:a)Draineachfueloilstoragetank,removetheaccumulated

sediment, andcleanthetank,orMomentary transients outsidetheloadandpowerfactorrangedonotinvalidate thistest.IfSurveillance Requirement 4.8.1.1.2.a.4 isnotsatisfactorily completed, itisnotnecessary torepeatthepreceding 8-hourtest.Instead,thedieselgenerator maybeoperatedat3500kwfor2hoursoruntiloperating temperature hasstabilized.

COOKiNUCLEARPLAiVI'-UNIT 1Page3/484Ail'IENDiWENT 42$,49, piEgtj 03/4LIMITINGCONDITIONS FOROPERATION ANDSURVEILLANCE REQUIREMENTS 3/4.8ELECTRICAL POWERSYSTEMSSURVEILLANCE REUIREMENTS Continued 4.8.1.1.2 Eachdieselgenerator shallbedemonstrated OPERABLE:

Inaccordance withthefrequency specified inTable4.8-1onaSTAGGERED TESTBASISby:1.Verifying thefuellevelinthedaytank,2.Verifying thefuellevelinthefuelstoragetank,3.Verifying thatthefueltransferpumpcanbestartedandthatittransfers fuelfromthestoragesystemtothedaytank,4.Verifying thatthedieselstartsfromstandbyconditions andachievesinlessthanorequalto10seconds,voltage=4160~420V,andfrequency

=60+1.2Hz,Verifying thedieselissynchronized andloadedandoperatesforgreaterthanorequalto60minutesataloadof3500kw,andVerifying thatthedieselgenerator isalignedtoprovidestandbypowertotheassociated emergency busses.Byremovingaccumulated water":1)Fromthedaytankatleastonceper31daysandaftereachoccasionwhenthedieselisoperatedforgreaterthan1hour,and2)Fromthestoragetanksatleastonceper31days.Bysamplingnewfueloil"inaccordance withtheapplicable guidelines ofASTMD4057-81priortoaddingnewfueltothestoragetanksand1)Byverifying, inaccordance withthetestsspecified inASTMD975-81andpriortoaddingthenewfueltothestoragetanks,thatthesamplehas:Thedieselgenerator start(10seconds)fromstandbyconditions shallbeperformed atleastonceper184daysinthesesurveillance tests.Allotherenginestartsforthepurposeofthissurveillance testingandcompensatory actionmaybeatreducedacceleration ratesasrecommended bythemanufacturer sothatmechanical stressandwearonthedieselengineareminimized.

Momentary loadtransients donotinvalidate thistest.Theactionstobetakenshouldanyoftheproperties befoundoutsideofspecified limitsaredefinedintheBases.COOKNUCLEARPLAiVT-UNIT 2Page3/48-3AMENDMENT

444, L)

~03/4LIMITINGCONDITIONS FOROPERATION ANDSURVEILLANCE REQUIREMENTS 3/4.8'ELECTRICAL POPOVERSYSTEMSSURVEILLANCE REUIREMENTS Continued c)Verifying thatallautomatic dieselgenerator trips,exceptengineoverspeed andgenerator differential, areautomatically bypasseduponlossofvoltageontheemergency busand/orSafetyInjection actuation signal.Verifying thatthedieselgenerator operatesatapowerfactoroflessthanorequalto0.86foratleast8hours.Duringthistestthedieselgenerator shallbeloadedto3500kw.Within5minutesaftercompleting this8-hourtest,performSurveillance Requirement 4.8.1.1.2.e.4 (atexistingconditions)."

Determine thattheauto-connected loadstoeachdieselgenerator donotexceed3500kw.Verifying thedieselgenerator's capability to:a)Synchronize withtheoffsitepowersourcewhilethegenerator isloadedwithitsemergency loadsuponasimulated restoration ofoffsitepower.b)Transferitsloadstotheoffsitepowersource,andc)Berestoredtoitsstandbystatus.10.Verifying thatwiththedieselgenerator operating inatestmodewhileconnected toitstestload,asimulated SafetyInjection signaloverrides thetestmodeby:=a)Returning thedieselgenerator tostandbyoperation, andb)Verifying theemergency loadsareservicedbyoffsitepower.11.Verifying thattheautomatic sequencetimingrelaysareOPERABLEwitheachloadsequencetimewithinplusorminus5%ofitsrequiredvalueandthateachloadissequenced onwithinthedesignallowable timelimit.Atleastonceper10yearsby:I)Employing oneofthefollowing cleaningmethodstocleanthefueloilstoragetanks:a)Draineachfueloilstoragetank,removetheaccumulated

sediment, andcleanthetank,orMomentary transients outsidetheloadandpowerfactorrangedonotinvalidate thistest.IfSurveillance Requirement 4.8.1.1.2.a 4isnotsatisfactorily completed, itisnotnecessary torepeatthepreceding 8-hourtest.Instead,thedieselgenerator maybeoperatedat3500kwfor2hoursoruntiloperating temperature hasstabilized.

COOKNUCLEARPLANT-UNIT 2Page3/48-6AMENDMENT

~,468, ATTACHMENT 4TOAEP:NRC:0896X COOKNUCLEARPLANTEMERGENCY DIESELGENERATOR LOAD-RUNPERFORMANCE ANDRELIABILITY DURINGSHORTANDLONGDURATIONTESTPERIODS r

Attachment 4pageIABSTRACTThefollowing studycomparesCookNuclearPlantemergency dieselgenerator performance duringrelatively shorttestrunstoperformance duringsignificantly longertestdurations.

A,statistical treatment ofdataoveratwentyyearperiodisusedtodevelopanestimateofcumulative failureprobability withrespecttotestruntime.Inaddition, areviewofpreviousemergency dieselgenerator performance studiesisusedtoprovideanindustrywidecomparison ofload-runfailureprobabilities.

Thestudyconcludes thatanendurance testdurationofeighthoursinlieuofthecurrenttwentyfourhourswouldbeacceptable fortheemergency dieselgenerators atCookNuclearPlant.AmericanElectricPower Attachment 4page2TABLEOFCONTENTSSection1.0Introduction

2.0 CookNuclearPlantDieselGenerators

2.1Specifications EcMajorComponents 2.2Operations Overview3.0ReviewofCookNuclearPlantTestData3.1ValidLoad-RunCriteria3.2InvalidLoad-RunCriteria3.3LongDurationLoad-RunData3.4ShortDurationLoad-RunData3.5FailureCharacteristics 3.6DataAnalysis4.0ReviewofSelectedStudies4.1BNLTechnical Report¹A-31341-854.2NSAC-1084.3NUREG/CR-5994 155.0IndustrySurveys6.0Conclusions

7.0 References

171718AmericanElectricFower

'lIt>kr Attachment 4.1.0Introduction page3Thisreportfocusesonemergency dieselgenerator (EDG)load-runperformance atCookNuclearPlant.Thereportconsiders bothlongdurationload-runs (greater60minutes)andshortdurationload-runs (60minutesorless).ThereportdoesnotconsiderEDGstartingreliability.

Thisreporthasfourprimaryobjectives:

1)Reviewtheload-runperformance ofemergency dieselgenerators (EDGs)atCookNuclearPlantwithemphasisonthelongdurationtestruns.2)Reviewexistingstudies,evaluations, anddatatodetermine ameasureofEDGload-runperformance onanindustrywidebasis.3)SampleEDG24hourendurance testrunperformance atothernuclearpowerplantstoprovidecomparison data.4)Construct ameaningful translation ofthisdatainconjunction withexistingstudies,evaluations, andotherdatatodetermine aqualitative benchmark forevaluating theacceptability ofreducingthe18monthEDGendurance testdurationlromthecurrent24hourrequirement forCookNuclearPlant.AmericanElectricPopover pt Attachment 4page42.0CookNuclearPlantDieselGenerators Thedatainsections2.1and2.2summarize important EDGspecifications andoperating requirements.

BothunitsatCookNuclearPlantareWestinghouse, 4-loop,pressurized waterreactors.

Unit1israted3250MWtandUnit2israted3411MWt.FourEDGs,twoperunit.EachdieselengineisaWorthington TypeSWB-12,12cylinder, heavydutyturbocharged dieselengine,withacontinuous ratedoutputof4900BHPat514RPM.Eachgenerator isaGeneralElectric, 4375KVA,3500KWat0.8P.F.,514RPM,3-phase,60-cycle, 4160V,25%voltageregulation, directengine-driven synchronous typegenerator.

Eachgenerator isequippedwithaGEbrushless excitertypeSARwithafieldrated5.8Aand100VDCand,astaticvoltageregulator withitsassociated potential andsensingtransformers.

TheEDGsystemforeachunitconsistsoftworedundant, Class1E,identical dieselgenerators whichareindividually capableofsupplying sufficient powertooperateonecompleteredundant trainofengineered safetyfeatures(ESF)andprotection systemsrequiredforsafeshutdownoftheunit.TheEDGsaredesignedtostartautomatically uponreceiptofasafetyinjection signalancVoralossofoffsitepowersignalandbereadytoacceptloadswithin10secondsofreceiving astartsignal.Duringnormalplantoperation, theEDGsareonstandbyandareautomatically available ifofBitepowerislost.AmericanElectricPopover IJCUNp'hEp)

Attachment 4page53.0ReviewofCookNuclearPlantTestDataThissectionconsiders load-runtestdatafrom1974to1994.Theobjectives ofthissectionincludeexamination ofload-rundataspecifically associated with24hoursurveillance tests.Accordingly, thestudycouldhavefocusedstrictlyon24hoursurveillance testruns.However,itwasfeltthatdoingsocouldeliminate, ormask,insightful observations aboutthe"quality" ofEDGperformance duringotherextendedfullload-runs andthecharacteristic behaviorofload-runfailures.

Inaddition, thelimiteddataavailable fiomthe24hoursurveillance testswasnotstatistically significant.

Evenbyincluding alllongduration(greaterthan60minutes)fullload-runs,thedatabasewasstilllimitedto128totaltests.Therefore, dataRomshortduration(60minutesorless)load-runs isprovidedbelowforcomparison andtofacilitate analysisofthelongdurationfullload-runs.

Inevaluating EDGtestdata,theboundaryandsupportsystemsoftheEDGsystemwereconsidered toincludethedieselengine,thegenerator, theexciterandvoltageregulator system,thecontrolandprotection system,theEDGlubricating oilsystem,EDGfueloilsystem,EDGjacketwatersystem,EDGstartingairsystem,EDGintakeairsystem,EDGexhaustgassystem,andthecontrolcircuitry uptotheimmediate controlpowersource.ThecriteriainSections3.1and3.2wereusedtoevaluatethevalidityofEDGtestruns.Thefollowing criteriawerebasedonreferences 5,10,and11.Aload-runwascountedasavaliddemand,success,orfailureifitsatisfied eitheroneofthefollowing criteria:

a.Termination'of theload-runpriortomissioncompletion, duetoabnormalconditions thatwouldultimately haveresultedinthefailureoftheEDG,wascountedasavaliddemandandfailure.b.Termination aftercompletion oftheintendedmissionwascountedasavaliddemandandsuccess.AmericaElectricPointer Attachment 4page6Thefollowing criteriawerebasedonreferences 5,10,and11.Aload-runwasnotcountedasavaliddemand,success,orfailurewhentheload-runwasprematurely terminated foranyofthefollowing reasons:a.Aspuriousoperation ofatripthatisbypassedintheemergency operating mode.b.Amalfunction ofequipment thatisnotoperative intheemergency operating mode.c.Anoperating errorthatwouldnothaveprevented theEDGGombeingrestarted andloadedwithinafewminutesandwithoutcorrective repairs.d.Observable abnormalconditions thatwouldnothaveprevented theEDGfromcompleting itsmissionduringanactualemergency demand.33rain-RnaThissectionexaminedEDGload-rundatawhichmetthefollowing criterion:

TheEDGwassuccessfully startedwithanintention tooperateatfullloadforadurationgreaterthan60minutes.Theabovecriterion wasused.toeliminate datafromthe1hourmonthlyruns,whichareperformed athalfload(1750KW),

andtocapturefull(3500KW)load-runmissionsofsignificant duration(greaterthan60minutes).

Also,thecriterion distinguishes betweenEDGload-rundataandEDGstartingdatabydefiningtheload-runphasetobeginonlyafterasuccessful start.Forcomparison andanalysispurposes, thedataf'romshortduration(60minutesorless)load-runs areprovidedseparately inSection3.4below.Usingtheabovecriterion, apopulation of128load-runs wasexamined.

Fromthispopulation, 2load-runs weredeletedbecausetheywereactualdemandswhichoperatedtheEDGatlessthanfullload.Also,3additional load-runs weredeletedbecausetheEDGwasnotoperatedatfullloadcontinuously duringthesurveillance duration.

AmericanElectricPopover Sic Attachment 4page7Examination oftheremaining datashowedthat16fullload-runmissionswereprematurely aborted.Thisdatarequiredengineering evaluation basedonthecriteriapresented insections3.1and3.2.Ingeneral,premature termination wasassociated withminorfueloilleaks,personnel error,orspuriousoperation ormalfunction ofequipment thatwouldnotbeoperative duringanemergency condition.

Outofthe16premature terminations, zeroterminations weredetermined tobevalidload-runfailures.

Theremaining 107load-runs providedapproximately 2,010hoursofload-rundataforanaverageruntimedurationofapproximately 19hours.3.4ShortDurationLoad-RunDataThissectionexaminedEDGload-rundatawhichmetthefollowing criterion:

TheEDGwassuccessfully startedwithanintention tooperateforadurationof'notmorethan60minutes.AspartoftheIndividual PlantExamination (IPE),datacollection andanalysiswerecompleted forEDGsovertheperiodJanuary1983throughDecember1992.Thetestdataprimarily examinedmonthlysurveillance runsandothershortdurationtestswhichinvolveloadingthedieseltoatleast1750KW.Thestudyreviewedatotalof929demandsandfound12startfailuresand3load-runfailures.

Pertheabovecriterion, the12startfailuresweresubtracted Romthe929demandstoyield917validload-rundemands.Also,basedonreviewofthedataandthecumulative runtimehours,itwasdetermined thatsomeofthe917demandsincludedrunsover1hour(someofthedemandswereactually24hourfullload-runs).

InSection3.3above,thelongdurationfullload-runmissionswereexamined.

Therefore, topreventdoublecountingandtocondition thesedemandstoaonehouraverageduration, 44successful demandsweredeletedGomthe917remaining demands.Thus,873demandsprovidedatotalof873hoursofoperation.'he 3load-runfailuresoccurredwithinthefirst30minutesofoperation duringroutinetesting.AmericanElectricPower

~IN,pP Attachment 4page835'IraeriiPriortoanalyzing theabovedata,itisimportant toreviewtheunderlying characteristics ofEDGfailures.

Ingeneral,EDGfailuresmayoccurasaresultofthefollowing:

a)Endofnor7rrallifeofaconrponent orpieceofeqrripment.

Ingeneral,preventative maintenance programswillreducethenumberofage-relatedcomponent failures.

However,thereissomestatistical uncertainty associated withEDGcomponent lifetimes.

Thisuncertainty createsthepossibility ofage-related failures.

Thus,EDGcomponents aresubjecttofailureaftera,requisite numberofcumulative servicehours,regardless ofthelengthofthesurveillance runduringwhichthefailureoccurs.Therefore, toproperlyinterpret theobservation ofacomponent failureduringanygivensurveillance, itisimportant tocarefully studythenatureofthefailuretodetermine ifthecomponent failurewasprecipitated bytheactualsurveillance durationor,rather,bythenormalexpectedlifetimeofacomponent (Appendix Bofreference 12,providesusefulinformation onage-related failuremechanisms).

Ifthefailuredistribution ofaparticular component isknown,thenthetimeoffailurecanbepredicted.

Therefore, itcanbeconcluded thatexcessive testingincreases theprobability ofsuchfailuresandthatthesurveillance testdurationshouldbeminimized toreducetheriskoffailureduringanactualdemand.b)Rcmdonrnralfirrrctr'on ofcomponents, desigrrarromalies, orincor7ect nraintenarrce.

Theseproblemsmaysurfaceoveranytimeinterval.

Inparticular, itisintuitively obviousthattheeffectsofsmalldeviations 6'ommaintenance procedures maybemoredifficult toidentifyandmayrequirealongertimetoappear.Thissuggeststhat,toidentifyallpossibleproblemsofthisnature,thesurveillance testdurationshouldbemaximized.

Notethatitems(a)and(b)presentcompeting requirements.

Accordingly, theobjective ofEDGsurveillance testingshouldbetoexposeasmanyofthetype"b"failuresaspossiblewithoutaccelerating thetype"a"failures.

If,however,thetesttimeexceedsanoptimalduration, T,thenthenumberoftype"a"failuresbeingintroduced couldtheoretically increasebeyondtheexposurerateoftype"b"failures.

Ideally,thesurveillance testdurationwouldbeselectedtominimizetype"a"AmericanElectricPopover E~~Agt Attachment 4page9failures.

Inthiscase,itcanbeshownthatagoodapproximation oftheoptimaltestduration, T,canbedetermined byusinganexponential probability densityfunctionfortheEDGfailureprob'ability.

Theformofthisfunctionisshownbelowandisfurtherdeveloped inSection3.6.wheret=timeand,A.anduareconstants.

Itisalsoworthnotingthatitisreasonable toexpectthat,foramachinethatisdesignedforextendedoperation atfullyloadedconditions, amajorityoftheprimaryfailuremodeswouldoccurbeforetheenginereachesthermalequilibrium (usuallywithin2hours).Engineequilibrium temperature isdefinedasthetimeatwhichthejacketwaterandlubeoiltemperatures arebothwithin+10'Foftheirnormaloperating temperatures established bytheenginemanufacturer (reference 11).Theexpectancy ofahigher.'ailure probability duringthefirsttwohoursofoperation isconsistent withCookNuclearPlantactualperformance data,asindicated inSections3.3and3.4.3~6DAdInconsideration ofthefailurecharacteristics discussed inSection3.5,thefollowing basicquestions wereaddressed inthisstudy:a)Hotvdoesfhefarlure probability Chrlingshortdurafionrunsconrparewilhlongdurationruns?b)OvertvhatfestdurationtvouldthemnjorityofFDGload-sanfailuresbeexpected?

Toanswertheabove'questions, itisnecessary todevelopatechnical approachforevaluating EDGunreliability asafunctionofsurveillance testtime.'herefore, thepurposeofthissectionistouseactualperformance datatoestablish a..statistical modelthatconservatively characterizes EDGfailureprobabilities overtime.AmericanElectricPoimr s44 Attachment 4page10Table1:DataSan>maryShortDurationLoad-RunData1983-1993TotalDemands873TotalFailuresAverageDurationHoursTotalHours873L'ongDurationLoad-RunData1974-1994TotalDemands107*cppQxUM1c vllllcTotalFailuresAverageDurationHours19'otalHours2,010VTheabovedatacanbereasonably characterized asasetofBernoulli trials.Thatis,eachvalidtest(ortrial)caneitherbeasuccessorfailure,eachsuccesshasaconstantprobability p,andeachtestisindependent oftheprevioustest.Itisrecognized thatsomeofthetestsmaynotbeindependent andidentical, however,inmanycasestheassumptions ofaseriesofBernoulli trialswillprovideagoodapproximation..

Therefore, thebinomialdistribution isareasonable selection forevaluating thistypeofdata.BinomialDistribution Z=(n!/[(n-x)!*x!])*p"*(I-p)'

whereZequalstheprobability thatoutofntrialsxfailureswillbeobservedgiventhefailureprobability, p.Also,itcanbeproventhatthemostprobablevalueofpisp=x/nForexample,fortheshortdurationruns,p~=3/873=0.0034andZ~=0.2244AmericanElectricPoiver Attachment 4page11However,forthelongdurationrunswithxt,W,adifferent approachmustbetakentocalculate p(i.e.,theresultpt,Wisnotstatistically meaningful toanswertheabovequestions).

Byutilizing thebinomialdistribution functionandtheabovedata,arangefortheparameter, p,canbedetermined forthelongdurationload-runs.

Foranygivenvalueofn,itcanbeshownthattheinequality, Z(x=0)>Z(x=1)isaboundingcaseandresultsinpp~and,therefore, 0.0034<pt<0.0093Forconservatism, assumept&.0093,thentheratioptgp~=274Toanswerquestion"a"above,thisresultmeansthatthefailureprobability associated withthelongdurationload-runs is2.74timesgreaterthanthefailureprobability forshortdurationload-runs.

TableZ:$0mmaryofFnilareProbabilities ShortOurationLoad-RunOataProbabilities 1983-1993¹Trialsn873FailuresXFailureProbability short0.0034FailureRate/Hour0.0034Zshort0.2244LongOurationLoad-RunProbabilities 1974-1994¹TrialsnFailuresXFailureProbability pLongFailureRate(/Hour)ZLong107a'calculated value.0.00930.0005'.3680 AmericanElectricPopover 8lLi4 Attachment 4page12Asdiscussed inSection3.5,theoptimaltestdurationwouldproducefailurespredominately duetotype"b"occurrences.

(random),

asopposedtotype"a"(component wear).Assuch,selecting anoptimaltestdurationwouldmeanthatnon-failureinprevioustestperiodswouldnotsignificantly changethefailureprobability inthefutureperiodsandalsothatthefailureratewouldbeapproximately constantovertime.Todetermine theoptimaltestduration, theintegraloftheprobability densityfunction, introduced inSection3.5,canbeusedtomodeltheprobability ofEDGfailuresthatcouldbeobservedoveratimeperiod;(O,t}.EDGFailureProbability

Function, P(t)P(t)=(afA,)[l-e']

wherecandA,areconstants.

TheconstantA,isdependent onthefailureprobability oftheshortandlongdurationload-runs whichweredefinedasshortdurationruns560minutes<longdurationnmsFromTables1and2above, att=1hour,P=0.0034andat t=19hours,P=0.0093.

Thesevaluescanbesubstituted intotheaboveexpression tofirstcalculate Xandthenct.Theresulting valuesareshownbelow.0,=0.004294 X,=0.4637Figure1,below,showsaplotofP(t)usingtheabovevaluesofaandA,overatimeperiod,t,fromzerototwenty-four hours.AmericanElectricPopover

\1k$

Attachment 4-page13EDGFailureProbability 0.00950.00900.00850.00800.00750.00700.00650.00600.0055P(t)0.00450.00400.00350.00300.00250.00200.00150.00100.00050.0000024681012141618202224TIME(hours)Figurel:PlotofI'(t)Figure1showsthatafterapproximately tenhourstheEDGfailureprobability would,increaseataveryslowrate(i.e.,dP(t)/dt=0).Tobetterunderstand thisresultandtoanswerquestion"b"above,aplotofP(t)normalized byP(M4hrs)isshownbelow.Atnerican ElectricPower 4h~J~lIl4 Attachment 4page14k1.00000.95000.90000.85000.80000.75000.70000.65000.60000.5500P(t)IP(24) 05000OA5000.40000.35000.30000.25000.20000.15000.10000.05000.00000Cumulative FailureProbability 24681012141618202224TIME(hovrs)

Fignre2:EDGCasnllati veFailureI'robability Fromfigure2,itcanbeseenthatapproximately 98%ofthefailuresoccurwithinthefirst8hourswhileonly60%occurwithinthefirst2hoursofoperation.

Thismaybeanoverlyconservative estimation fiomthestandpoint that,atCookNuclearPlant,alloftheactualobservedfailuresoccurredwithinthefirst2hoursofoperation.

AmericanElectricPopover 4~1r~1'Wp'IIP4y'l~rtW Attachment 4page154.0ReviewofSelectedStudiesThepurposeofthissectionistoprovideameasureofEDGload-runperformance onanindustrywidebasis.Thestudiesreviewedbelowwereselectedbecausetheyprovideddiscernible EDGperformance dataduringtheload-runphaseofoperation.

(reference 7)In1985,Brookhaven NationalLaboratory completed astudytoexamineEDGperformance atNuclearPowerPlantsintheUnitedStatesduringafouryearperiod,from1980through1983.Thereportdidnotdistinguish betweenstartandload-runfailuresbut,rather,calculated overallfailureratesnormalized bytotalEDGyearsofoperation.

DatawascompiledfromLERfiles,10CFR50.55(e) reports,NuclearPlantReliability DataSystem,andElectricPowerResearchInstitute documentfiles.Thestudyincluded158EDGs,producedby12different manufacturers (including Worthington),

foratotalof588EDGyears.Thereportedtotalcomposite numberoffailureswas396whichcorresponds toafailurerateofapproximately 0.7failuresperEDGyear.Thereportalsostudiedthefailuremodesofdifferent EDGmanufacturers, withtheexception ofTrans-America Delaval.Also,thestudyprovidedaqualitative presentation ofpredominant failuremodesbasedonthenumberofreportedfailures.

Reviewofthereportindicates thatthefivemostdominantfailuremodesincludedinstrumentation andcontrolssystems,lubricating oilsystems,speedandloadcontrol,coolingwatersystems,andstartingsystems.In1986,EPRIcompleted acomprehensive studyofEDGsuccess/failure experience atNuclearPowerPlantsintheUnitedStatesduringathreeyearperiodfrom1983through1985.Thestudyreviewedstartandload-runreliability.

Thecriteriausedtoevaluateload-rundatawassimilartothatusedinSection3.0above.Theload-rundatabaseincludedbothplannelandunplanned (actual)demandsthatinvolvedEDGoperation atgreaterthan50%ofplantessential safetyfunctionloadratingforonehourorlonger.Fortheperiodunderstudy,adatabaseof13,808load-runs wasassembled.

Thestudyreported138load-runfailureswhichcorresponded toanEDGunreliability of0.0100failuresperdemand.AmericanElectricPoiver C

Attachment 4page16/R-54(reference 4)In1994,NUREG/CR-5994 presented recentoperating experience toassessEDGunavailability duetotesting,maintenance, andfailuresduringreactorpoweroperation andduringplantshutdown.

Section3ofthereportprovidedEDGindustry-wide performance dataoverfouryears,1988through1991,andusedtheempirical Hayes.methodtoanalyzeEDGMuredata.Thedatacovers195EDGsat63plantsitesandincludesbothactualandtestload-rundata.Forplantsites,themeanload-runfailureprobability was9.5E-03failuresperdemandwithavarianceof2.9E-05.Tnble3:EDGIndustry->vide FnilareProbability History1980-1983(reference 7)numberofFailures396'umber ofEDGs158numberofEDGears588failuresperEDGear0.71983-1985(reference 5)numberofFailures138numberofEDGs154numberofload-runs 13,808failuresperdemand0.011988-1991(reference 4)numberofFailures182numberofEDGs195numberofload-runs 19,520failuresperdemand0.0095'Includes bothstart4loadiefailures.

AmericanElectricPotver Attachment 4page175.0IndustSurvesInanefforttoprovidemorerecentEDGperformance data,alimitedinformalindustrysurveywasconducted tospecifically determine theapproximate numberoffailuresoccurring before8hoursandthenumberoffailuresoccurring after8hoursduringthe18month24hoursurveillance test.Reviewofthedataindicated thattheindustiy-wide EDGfailureratesduringthe24hoursurveillance tendtosupportthepreviousstudiesdiscussed inSection4.0(i.e,.failures/load-run demand<0.01).6.0Conclusions Examination ofthefullloadrundataontheEDGsatCookNuclearPlantrevealedthat3validload-runMuresoccurredduringshortdurationruns(t~60minutes)andzerofailuresoccurredduringlongdurationruns(t>60minutes).

Aconservative, statistically based,mathematical modelwasdeveloped todetermine thereliability oftheEDGduringtheload-runphaseoftestingasafunctionoftime.Themodelpredicated that60%ofthevalidload-runfailureswouldoccurwithinthefirsttwohoursof.operation, 95%inthefirst6.5hours,and98%inthefirsteighthours.Also,themorerecentindustrysurveys,including theinformalrandomsurveysdiscussed inSection5.0,areveryconsistent withtheresultsfoundatCookNuclearPlant(i.e.,failures/load-run demand<0.01).Asexplained inSection3.5,theobjective oftheendurance testshouldbetoexposeasmanyoftherandomtypefailuresaspossibleandtominimizeEDGcomponent wear.Thus,theoptimalsurveillance testduration, T,shouldbeselectedtoprovidereasonable assurance thatthemajorityofincipient randomfailuresareexposedwithoutadversely impacting EDGavailability, foranactualemergency demand.Also,consistent withactualperformance dataandengineering

judgment, theperiodofliigheststresswouldoccurduringstartupandbeforeequilibrium conditions areestablished (05T<2hours).Therefore, basedonactualperformance dataandrelatedindustry-wide surveys,anendurance testdurationofT=8hoursisrecommended toprovidethenecessary insightaboutEDGreliability.

Testdurations greaterthaneighthourswouldnotprovideasignificant operating safetybenefitandwouldonlyservetoincreasecumulative runtimeandthelikelihood ofage-relatedcomponent failures.

AmericanElectricPosver

~~iQt Attachment 47.0References page181)"AReliability ProgramforEmergency DieselGenerators atNuclearPowerPlants-ProgramStructure,"

NUREG/CR-5078, SAND87-7176, Vol.1,April1988.2)"AReliability ProgramforEmergency DieselGenerators atNuclearPowerPlants-Maintenance, Surveillance, andCondition Monitoring,"

NUREG/CR-5078, SAND87-7176,Vol.2,December1988.3)"Improvements toTechnical Specification Surveillance Requirements,"

NUIREG-1366, December1992.4)"Emergency DieselGenerator:

Maintenance andFailureUnavailability, andTheirRiskImpacts,"

NUREG/CR-5994, BNL-NUREG-52363, November1994.5)"TheReliability ofEmergency DieselGenerators atU.S.NuclearPowerPlants,"NSAC-108,September 1986.6)"ASimulation Study:Emergency DieselGenerator Availability,"

EPRINP-1759,Interim.Report,March1981.7)"AReviewofEmergency DieselGenerator Performance atNuclearPowerPlants,"Brookhaven NationalLaboratory, Technical ReportA-31341-85,January1985.8)"Guidelines andTechnical BasesforNUMARCInitiatives Addressing StationBlackoutatLightWaterReactors,"

NU1VIARC87-00,Rev.1,August1991.9)"Periodic TestingofDieselGenerator UnitsUsedasOnsiteElectricPowerSystemsat.NuclearPowerPlants,"Regulatory Guide1.108,Revision1,August1977.10)"Selection, Design,Qualification, andTestingofEmergency DieselGenerator UnitsUsedasClass1EOnsiteElectricPowerSystemsatNuclearPowerPlants,"Regulatory Guide1.9,Revision3,July1993.11)"IEEEStandardPeriodicTestingofDiesel-Generator UnitsAppliedasStandbyPowerSuppliesinNuclearPowerGenerating Stations,"

IEEEStd749-1983.

12)"IEEEStandardCriteriaforDiesel-Generator UnitsAppliedasStandbyPowerSuppliesinNuclearPowerGenerating Stations,"

IEEEStd387-1984.

AmericanElectricPower 1~lll'lai Attachment 4page1913)."IEEEGuidetotheCollection andPresentation ofElectrical, Electronic, SensingComponent, andMechanical Equipment Reliability DataforNuclear-Power Generating Stations,".IEEE Std500-198414)"Resolution ofGenericSafetyIssueB-56,DieselGenerator Reliability,"

SECY-93-044,

~02/22f93.

AmericanElectricPointer Pph ATTACHMENT 5TOAEP:NRC:0896X DONALDC.COOKNUCLEARPLANTCOSTBENEFICIAL LICENSING ACTIONEDGSURVEILLANCE TESTINGTECHNICAL SPECIFICATION CHANGES I4Erf,'%jg Attachment 5toAEP:NRC:0896K Page1Regulatory Requirement:

Technical Specification T/S4.8.1.1.2.e.7 requiresscheduling ofEDG18monthsurveillance duringshutdown(refueling outages)andperforming a24hourendurance testrun.EffectofRequirement:

Thepresent18month24hourEDGendurance testdoesnotprovideasafetybenefitcommensurate withitscost.Inaddition, performing therequiredtestingcausescriticalpathcomplications anddelaysduringtheoutage.Rationale forRegulatory Change:Therationale fortheproposedchangesisthattheintentofregulatory surveillance requirement todemonstrate theabilityoftheEDGtooperateforanextendedperiodoftimeunderfullyloadedconditions willbepreserved bymaintaining an8hourendurance testrun.Atthesametime,thesechangeswillbetterutilizeplantresources andpreventcriticalpathcomplications duringtheoutages.Unnecessary dieselgenerator stressandwearwillalsobereduced.Additionally, thereduction from24to8hourswillincreasedieselavailability and,thereby,reduceshutdownrisk.Approximate CostofRequirement:

Thecostsavingsassociated withreducingthe18month24hourEDGsurveillance testdurationisprovidedbelow.Thecostsavingswascalculated usinganestimateoflaborandmaterials requiredforperforming the24hourendurance run(ontwodieselsperunit)andmultiplying thisestimatebytheproposedreduction insurveillance duration.

Unit1:remaining cycles13Unit2:remaining cycles152*13*16,000*16/24

$277,3332*15*16,000*16/24

$320,000Totalplantlifetimesavingsisapproximately

$600,000.P

~e4